EUVD-2026-70038

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...

CVE-2026-4357 Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites...

mgo3-rce

MGO3 RCE 이 저장소는 CVE-2026-19874에 관한 정보를 포함합니다. 문서 데모 영상 타임라인 2026-06-26: 취약점 발견 2026-06-26: 코나미에 첫 연락 2026-07-01: 취약점이 코나미에 보고됨 2026-08-04: 취약점이 코나미에 의해 조용히 패치됨 https://steamdb.info/patchnotes/24176213/ 면책 조항 이 소프트웨어는 순전히 학술 연구 목적으로 제작되었습니다. 다른 시스템을 공격하는 데 사용하기 위한 것이 아닙니다. 프로젝트 관리자는 소프트웨어의 오용에 대해...

CVE-2023-31014_Lab

Лаборатория перехвата неявных Intent CVE-2023-31014 Образовательная Android-лаборатория, созданная на основе публичного отчёта об уязвимости CVE-2023-31014 в NVIDIA GeForce NOW для Android. Не содержит исходный код NVIDIA, реальные строки Action и реальные учётные данные. Факты из публичного отчё...

CVE-2024-24136

CVE-2024-24136 : Gioco matematico Cross-Site-Scripting Prova di concettoPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24136.md Prova di concettoPoC : https://github.com/BurakSevben/CVE-2024-24136/blob/main/CVE-2024-24136.md...

MINI-RPG2-W5CX-H3PX

Bulletin has no description...

Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it's designed to rig live game results on Digitain. The package, named "Newtonsoftt.Json.Net," masquerades as the...

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...

ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation. Old bugs are back, weak defaults are earni...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

PT-2026-58211

Name of the Vulnerable Software and Affected Versions Age of Empires II: Definitive Edition affected versions not specified Description A relative path traversal issue allows an unauthorized attacker to achieve remote code execution over a network. The attack occurs when a user joins an...

MAL-2026-7034 Malicious code in @alphasedboy/game (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @alphasedboy/game (npm)

--- -= Per source details. Do not edit below this line.=-...

New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials

Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking , a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. The targets...

CVE-2026-7167 Multiple vulnerabilities in the Assassin game by Gaudire

The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process, allowing unverified or fake email addresses to be accepted. This lack of validation enables the creation of user accounts with fake email addresses, facilitating the mass...

CVE-2026-7166

CVE-2026-7166 affects the Assassin game by Gaudire. The API and local database expose sensitive data via the email and telefon fields, including data on minors and municipal users. This unauthenticated remote access could compromise confidentiality (CVSS 4.0 base 9.2, HIGH impact). No exploit or ...

CVE-2017-20271

Joomla StreetGuessr Game 1.1.8 is affected by an SQL injection via the catid parameter in index.php when using option=com_streetguess&view=maps. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries and exfiltrate data such as database version and names. Reported CVS...

CVE-2017-20271 Joomla StreetGuessr Game 1.1.8 SQL Injection via catid

Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=comstreetguess&view=maps parameters a...

CVE-2017-20271

Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=comstreetguess&view=maps parameters a...